[PR #1962] [CLOSED] fix DTVCC: Structural type confusion / OOB writes

## 📋 Pull Request Information **Original PR:** https://github.com/CCExtractor/ccextractor/pull/1962 **Author:** [@THE-Amrit-mahto-05](https://github.com/THE-Amrit-mahto-05) **Created:** 1/2/2026 **Status:** ❌ Closed **Base:** `master` ← **Head:** `fix/dtvcc-structural-oob` --- ### 📝 Commits (2) - [`5dc8292`](https://github.com/CCExtractor/ccextractor/commit/5dc8292dd22c5fc523b2d11a69990ab8e4b23112) Fix out-of-bounds read in H.264 SEI parsing - [`82109e6`](https://github.com/CCExtractor/ccextractor/commit/82109e6cd9c16c558868de8f75f299eade0cad70) Fix DTVCC structural type confusion and OOB writes (#1961) ### 📊 Changes **2 files changed** (+46 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/lib_ccx/avc_functions.c` (+8 -2) 📝 `src/lib_ccx/ccx_decoders_708.c` (+38 -0) </details> ### 📄 Description  **In raising this pull request, I confirm the following (please check boxes):** - [x] I have read and understood the [contributors guide](https://github.com/CCExtractor/ccextractor/blob/master/.github/CONTRIBUTING.md). - [x] I have checked that another pull request for this purpose does not exist. - [x] I have considered, and confirmed that this submission will be valuable to others. - [x] I accept that this submission may not be used, and the pull request closed at the will of the maintainer. - [x] I give this submission freely, and claim no ownership to its content. - [x] **I have mentioned this change in the [changelog](https://github.com/CCExtractor/ccextractor/blob/master/docs/CHANGES.TXT).** **My familiarity with the project is as follows (check one):** - [ ] I have never used CCExtractor. - [ ] I have used CCExtractor just a couple of times. - [ ] I absolutely love CCExtractor, but have not contributed previously. - [x] I am an active contributor to CCExtractor. --- **Title:** `[FIX] DTVCC: Structural type confusion / OOB writes (#1961)` **Description:** This PR addresses a critical structural type confusion and out-of-bounds (OOB) write in the DTVCC (CEA-708) decoder. **Issue:** #1961 **Problem:** Malformed or malicious CEA-708 streams could define windows with row/column counts exceeding the maximums. This could lead to: - Heap buffer over-reads - Reading struct members as pointers (information leak) - Overwriting TV screen metadata - Undefined behavior during caption extraction **Fix implemented:** - Added bounds checks for `row_count` and `col_count` in `dtvcc_handle_DFx_DefineWindow`. - Added safety checks for `pen_row` and `pen_column` in `dtvcc_process_character` and `dtvcc_handle_SPL_SetPenLocation`. - Added invariant check in `dtvcc_window_copy_to_screen` to reject windows exceeding maximum dimensions. - Logging added for invalid dimensions and pen positions for easier debugging. **Impact:** - Prevents out-of-bounds memory access. - Ensures decoder robustness against malformed streams. **Testing:** - Verified windows exceeding `CCX_DTVCC_MAX_ROWS/COLUMNS` are rejected. - Verified pen positions outside valid bounds are ignored safely. - Confirmed normal streams continue to work correctly with no regression. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

claunia commented

2026-01-29 17:23:47 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/CCExtractor/ccextractor/pull/1962
Author: @THE-Amrit-mahto-05
Created: 1/2/2026
Status: ❌ Closed

Base: master ← Head: fix/dtvcc-structural-oob

📝 Commits (2)

5dc8292 Fix out-of-bounds read in H.264 SEI parsing
82109e6 Fix DTVCC structural type confusion and OOB writes (#1961)

📊 Changes

2 files changed (+46 additions, -2 deletions)

View changed files

📝 src/lib_ccx/avc_functions.c (+8 -2)
📝 src/lib_ccx/ccx_decoders_708.c (+38 -0)

📄 Description

In raising this pull request, I confirm the following (please check boxes):

I have read and understood the contributors guide.
I have checked that another pull request for this purpose does not exist.
I have considered, and confirmed that this submission will be valuable to others.
I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
I give this submission freely, and claim no ownership to its content.
I have mentioned this change in the changelog.

My familiarity with the project is as follows (check one):

I have never used CCExtractor.
I have used CCExtractor just a couple of times.
I absolutely love CCExtractor, but have not contributed previously.
I am an active contributor to CCExtractor.

Title: [FIX] DTVCC: Structural type confusion / OOB writes (#1961)

Description:
This PR addresses a critical structural type confusion and out-of-bounds (OOB) write in the DTVCC (CEA-708) decoder.

Issue: #1961

Problem:
Malformed or malicious CEA-708 streams could define windows with row/column counts exceeding the maximums. This could lead to:

Heap buffer over-reads
Reading struct members as pointers (information leak)
Overwriting TV screen metadata
Undefined behavior during caption extraction

Fix implemented:

Added bounds checks for row_count and col_count in dtvcc_handle_DFx_DefineWindow.
Added safety checks for pen_row and pen_column in dtvcc_process_character and dtvcc_handle_SPL_SetPenLocation.
Added invariant check in dtvcc_window_copy_to_screen to reject windows exceeding maximum dimensions.
Logging added for invalid dimensions and pen positions for easier debugging.

Impact:

Prevents out-of-bounds memory access.
Ensures decoder robustness against malformed streams.

Testing:

Verified windows exceeding CCX_DTVCC_MAX_ROWS/COLUMNS are rejected.
Verified pen positions outside valid bounds are ignored safely.
Confirmed normal streams continue to work correctly with no regression.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

claunia added the pull-request label 2026-01-29 17:23:47 +00:00

[PR #1962] [CLOSED] fix DTVCC: Structural type confusion / OOB writes #2761

📋 Pull Request Information

📝 Commits (2)

📊 Changes

📄 Description